CVE-2026-38444: osTicket Stored XSS Vulnerability

CVE-2026-38444 Overview

CVE-2026-38444 is a stored Cross-Site Scripting (XSS) vulnerability in osTicket v1.18.3. The flaw resides in include/class.mailparse.php, where the email From header display name is extracted without sanitization. The unsanitized value is written to the poster field of the ost_thread_entry table and rendered back in the ticket thread interface.

An unauthenticated attacker can send a reply email to an existing ticket from an unregistered address, embedding a JavaScript payload in the From display name. When staff or clients later view the ticket thread, the payload executes in their browser session. The issue is tracked as CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browsers of osTicket agents and users by sending a specially crafted reply email, enabling session hijacking and UI defacement in the helpdesk console.

Affected Products

osTicket v1.18.3
osTicket helpdesk instances processing inbound email via class.mailparse.php
Deployments rendering thread entries with the unsanitized poster field

Discovery Timeline

2026-08-03 - CVE-2026-38444 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-38444

Vulnerability Analysis

osTicket ingests inbound email through the Mail_Parse component in include/class.mailparse.php. When constructing a new thread entry, the parser extracts the sender's display name from the RFC 5322 From header and passes it as the poster attribute. The value is persisted directly into ost_thread_entry.poster without HTML encoding.

When the thread entry template renders the ticket history, the stored value is echoed into the DOM without escaping. Any HTML or JavaScript included in the display name executes with the privileges of the viewing user, whether that is an authenticated staff agent or an end user viewing the client portal.

Because email ingestion accepts messages from any address, and the vulnerable path activates for replies to existing tickets from unregistered senders, no authentication or prior account is required to store the payload.

Root Cause

The root cause is missing output encoding and input sanitization on the email display name. Two code paths contribute: the ingestion path in class.mailparse.php stores the raw poster string, and the rendering path in client/templates/thread-entry.tmpl.php prints $name without applying Format::htmlchars. Neither layer enforces the escaping that would neutralize embedded markup.

Attack Vector

The attacker crafts an email to the osTicket inbound address that references an existing ticket identifier in the subject. The From header uses a display name containing an XSS payload, for example "<img src=x onerror=alert(1)>" <attacker@example.com>. The sender address is not required to belong to a registered user. Once the mail fetcher processes the message, the payload is stored and triggered on every subsequent view of that thread entry.

php

// Patch in include/class.thread.php - sanitize poster on insert
            'format' => $vars['body']->getType(),
            'staff_id' => $vars['staffId'],
            'user_id' => $vars['userId'],
-            'poster' => $poster,
+            'poster' => Format::sanitize($poster),
            'source' => $vars['source'],
            'flags' => $vars['flags'] ?: 0,
        ));

Source: osTicket commit c54a6ac

php

// Patch in include/client/templates/thread-entry.tmpl.php - escape on render
        </span>
    </div>
<?php
-            echo sprintf(__('<b>%s</b> posted %s'), $name,
+            echo sprintf(__('<b>%s</b> posted %s'), Format::htmlchars($name),
                sprintf('<time datetime="%s" title="%s">%s</time>',
                    date(DateTime::W3C, Misc::db2gmtime($entry->created)),
                    Format::daydatetime($entry->created),

Source: osTicket commit c54a6ac

The patch applies Format::sanitize() on storage and Format::htmlchars() on rendering, closing both the ingestion and output layers.

Detection Methods for CVE-2026-38444

Indicators of Compromise

Rows in ost_thread_entry where the poster column contains HTML tags such as <script, <img, <svg, or event handlers like onerror= and onload=
Inbound emails whose From header display name contains angle brackets, quotes, or JavaScript keywords
Ticket threads originating from unregistered email addresses that coincide with unexpected client-side script execution

Detection Strategies

Query the ost_thread_entry table for poster values matching a regex for HTML markup or JavaScript event handlers.
Inspect mail server logs and osTicket fetch logs for From headers containing suspicious characters before parsing.
Deploy a Content Security Policy (CSP) in report-only mode on the osTicket web interface to surface inline script violations.

Monitoring Recommendations

Monitor web server access logs for agent sessions loading ticket views that immediately trigger outbound requests to unfamiliar domains.
Alert on browser console errors or CSP violation reports generated from the /scp/tickets.php and client portal ticket view endpoints.
Track newly created tickets from previously unseen sender domains and correlate with staff account activity anomalies.

How to Mitigate CVE-2026-38444

Immediate Actions Required

Apply the upstream osTicket patch from commit c54a6ac79de42cff35b453882d1d94cd38adb17f, which sanitizes the poster field and escapes it on render.
Audit ost_thread_entry.poster for existing malicious payloads and sanitize or purge affected rows.
Rotate staff session cookies and reset agent passwords if any indicators of exploitation are found.

Patch Information

The fix is available in the osTicket upstream repository via commit c54a6ac79de42cff35b453882d1d94cd38adb17f. It introduces Format::sanitize($poster) in include/class.thread.php when inserting thread entries, and applies Format::htmlchars($name) in include/client/templates/thread-entry.tmpl.php during rendering. Administrators running v1.18.3 should upgrade to a build that includes this commit. Reference the GitHub CVE disclosure for exploitation context.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts on both the staff control panel and client portal.
Add a mail filter or pre-processor that strips HTML metacharacters from the From display name before osTicket ingests the message.
Restrict inbound email processing to allowlisted domains where feasible until the patched version is deployed.

bash

# Example Apache CSP header to limit inline script execution on osTicket
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"